Bug 112653 – Crash in Document::setFocusedNode if the frame of new focused node is detached in 'change' event handler

• Component: DOM
• Status: RESOLVED FIXED

[Kent Tamura]

https://code.google.com/p/chromium/issues/detail?id=201134

Reduction:
<div>
 <input value="foo"></input>
 <iframe frameborder="0" id="input" height="100" width="540" srcdoc="&lt;input autofocus>"></iframe>
</div>
<script>
addEventListener("change", function(e) {
    document.body.appendChild(document.getElementById("input"));
    document.body.appendChild(document.createTextNode("PASS"));
}, false);
</script>


1. Open the above document
2. Click on the left input field
3. Modify it
4. Click on the right input field
 --> Crash by null pointer deference

[Kent Tamura]

Created attachment 193724 [details]
Patch

[WebKit Review Bot]

Comment on attachment 193724 [details]
Patch

Clearing flags on attachment: 193724

Committed r146393: <http://trac.webkit.org/changeset/146393>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.